Cloud computing has become popular as organizations are discovering that it provides a cost-effective, scalable, and flexible option to deliver business or consume IT (Information Technology) services over a network environment such as the Internet. Cloud computing presents unique issues in terms of data security. A honeypot is a data security tool used to lure attackers and analyze attacker activity in computing environments. Use of honeypots in cloud environments is generally limited to generation of additional environments, some of which are honeypots with falsified data.
The concept of a honeypot for data security was introduced as an information system resource that helps to detect unauthorized use such as malicious attacks. There are two main types of honeypots: a production honeypot to protect an organization, and a research honeypot to predict, monitor, and learn. Honeypots can be automatically provisioned in cloud environments, and provisioned based on attacker activity. However, these solutions have considerable drawbacks of affecting either valid users or attacker system usage, which limits the value of the honeypot. As a result, traditional automated honeypot generation in a cloud environment suffers from several major limitations. For example, in systems that create honeypots up front (e.g., multiple application environments where one environment is the true environment), legitimate users still need to be routed to the valid environment. Therefore, sophisticated attackers can identify the valid environment with relative ease, and the value of the decoy (honeypot) environments is limited mainly to non-targeted attackers that would stumble onto such an environment. Systems that create honeypots in response to an attack suffer from the same problem in the other direction: if a valid system is being migrated away from an exposed system, valid users need to be migrated to the new, valid system. An attacker can simply monitor the valid user flow to recognize that a compromised environment has been converted into a honeypot.